Cisco Support Community
Showing results for 
Search instead for 
Did you mean: 

Welcome to Cisco Support Community. We would love to have your feedback.

For an introduction to the new site, click here. And see here for current known issues.

New Member

NAC with CTA and VPN Concentrator, Does not detect CTA client

Hi all,

I've been working hard to solve a problem with CTA client NAC posture validation across a VPN 3000 Concentrator.

I have a fully working setup with routers for phase 1 NAC. When i plug a PC into a switchport everything with NAC works perfectly.

Then i've tried doing the same on my vpn concentrator. But when i plug exactly the same pc onto my public interface and start a VPN client. I'm being authenticated and gets access. But the access is as a "Clientless" or non-responsive/unknown client !! (even the access-lists for my clientless clients are being downloaded and works). So the connection to the ACS works.

But what is wrong ? since the VPN concentrator does apparantly not detect the CTA client ?

I've tried changing the public filter and allowing all incoming UDP. But it still does not work.

Do anyone have any pointers on this subject ?

Thanks in advance,


New Member

Re: NAC with CTA and VPN Concentrator, Does not detect CTA clien

Hi Lasse

Hope you are well. I am not sure how much help I can be on this (as I am having trouble getting the router to talk to the ACS), but I did find that whenever I tried to connect, the debugs on the router said CTA not detected. I am also running a Cisco VPN client. So I turned off the firewall and immediately, the router recognised that the Trust Agent was there. Could this be your problem?

Now, back to try and get my 2811 to talk to the ACS (very odd)!

New Member

Re: NAC with CTA and VPN Concentrator, Does not detect CTA clien

Hi Lasse,

Any luck resolving this? I have a simular problem with my VPN concentrator/ASC Radius set-up. PV tokens doen't seemed to be passed. Cisco says I'm missing a posturevalidation.dll from my acs install directory. Does your set-up have this file?



CreatePlease login to create content